Capability Maturity Model on Bill Brown:Thoughts and Reference Material Online

Comparing BSIMM and SAMM Software Security Models

Fri, 19 Jun 2026 00:00:00 +0000

Comparing BSIMM and SAMM Software Security Models

The role of the information assurance security program as described by Sadiku, Alam, & Musa (2017) is the practice of protecting and defending information systems by ensuring their availability, confidentiality, integrity, authentication, and non-repudiation. Information assurance is increasing in importance as threats abound in the connected and distributed information sharing networking and information systems. Many organizations do not know how mature there information assurance and security program, process and the procedure is. Implementing an Information Security Assurance Capability Maturity Model (ISA-CCM) can assist the organization in maturing the information assurance and security program as described by Security Horizon. (2012). The Capability Maturity Model (CMM) does not assist an organization in how things are not operating correctly but provides a roadmap for the organization to change the culture as Krebs (2015) points out.

Applying the ISA-CMM: A Cloud E-Store Case Study

Thu, 18 Jun 2026 00:00:00 +0000

Applying the ISA-CMM: A Cloud E-Store Case Study

Company A (CA) is a major supplier of satellite imagery to commercial, federal and defense vertical markets. The organization launched an e-commerce website on the Internet or an estore enabling customers to navigate, review and purchase satellite imagery. This applied case study is to perform an Information Security Assurance Capability Maturity Model (ISA-CMM) to improve the predictability, control, and process effective using the estore at CA as the focus. The ISA-CMM process as described by Security Horizon (2012) is a sequence of steps performed or followed to achieve a specific process. The Capability Maturity Model (CMM) is a guide to assist the company in achieving statistical process control. Process maturity shows the amount to which a detailed process is defined, managed, measured, controlled, and believed effective as described by Security Horizon (2012).